From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752673AbdJTOb0 (ORCPT ); Fri, 20 Oct 2017 10:31:26 -0400 Received: from mail-dm3nam03on0088.outbound.protection.outlook.com ([104.47.41.88]:47104 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752571AbdJTObU (ORCPT ); Fri, 20 Oct 2017 10:31:20 -0400 From: Brijesh Singh To: x86@kernel.org, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Borislav Petkov , Tom Lendacky , Brijesh Singh , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Borislav Petkov , Andy Lutomirski Subject: [Part1 PATCH v7 02/17] x86/mm: Add Secure Encrypted Virtualization (SEV) support Date: Fri, 20 Oct 2017 09:30:44 -0500 Message-Id: <20171020143059.3291-3-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20171020143059.3291-1-brijesh.singh@amd.com> References: <20171020143059.3291-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: BN6PR14CA0029.namprd14.prod.outlook.com (10.171.172.143) To SN1PR12MB0160.namprd12.prod.outlook.com (10.162.3.147) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 787b08ca-2e00-4be3-08f6-08d517c738bd X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081)(4534020)(4602075)(4627075)(201703031133081)(201702281549075)(2017052603229);SRVR:SN1PR12MB0160; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;3:9gAYXv0c0lu0pDNzWW6xVKbkYCL9/DGabo+Ltwyu0hRGC7aE95PjezagxO7Fz5V/CQLNZM4s9Sg0eqDYTrvf26RHhoEjP10sr1ByffniQKm0xtgbJK9ZiSVSu3Ak0Mdgvk6x3y6GFh5T18EpSJjtFx0OAj4lrkNxwryLOVskEn+oPgkfiOZ4QtEJZkChPl6pU1ja0jV+CnTVi8QOUVCE6OlbVjrpOga9fxxDsjTLRFtB/U1u23XNzI7LCLWwJVP/;25:a8+nwJ7xtZLJeKoQlf5+Jy5Awv2DpvpyGifpw/bxAMgscxYDzAt3zJBBIlDM8bVIMdG70hcGNHiKiCrHQTerQfn/0uY8g0ZkA1K6F4lvrndReebXGTo3+ml+hNzsmFnK8/vGXY1Mh0nCbiTs+rpw9WeSc4Yu/s45kqIUOi/ezfPXmqK5taATpCTDuoAqX5b66sF/qcDsItZ+bGlj5hignAyADf7/l1+88CBrXObmghaYoAqvULJ5NL/0WDCgKQuXhaE+ZuChSjSHZNFD8l/fFondMI9JZ4JShddoAt4OvUVw7Mw8bnVzK+u5HnJo2l4PP38EH/zRYbztitPklBCXuQ==;31:/QYxiLtlPBdFG6enc88oPruRaxhzg8jjjTiChIYA/YBLLy9HjqbtF17sSqfCU8uSOZk9+dob0aUjiRLUP/Tn6FOkxM2EiUzGSB8FX5iLJJFqyqykimu3AunvCOy8epa8xW/Zn8j6bjhFakhmnZ8cvJZyBcJh4URdUlRMEftbnDpAdLoI1sS+kRkjDi8XFyZ5uCe2ZIZdO/7N8DVqL5RfEzS/qUO5gtnOHYx7mXWFaA0= X-MS-TrafficTypeDiagnostic: SN1PR12MB0160: X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;20:DLyo43Qa6WWBvmBsrGGK2c2cdHfPROCpeda7a7CAo/njfAN7KDYSenas7yjtlVtR/EgiToYj9SX9atkUkkSUHB8uiYHDLAywfwVyqz0lt+YwLijsFl6R3jMLZr0zlkLgfEqNhqD4SXQ10jis1LzTcaWQf2lOcmFhKJ+N1NMPYffQgK2fUWjZ0xhX7dbFv5be81rE7bn+PxFKCUz+0C/PpPa4xx3DQweHBvPLEXLJM3F9bcj7Hv1mJiu02OdBUNLVjjMP8kprJa7ksEVDQbDXRQp+vfJrAfiYWHDIVxEUf6/wL94Y5fJTmZfQav2yLwznJjfQoUiRu8kse3pWaFIhBtn/4SljFKdDncqtLsKPHIkbyr4q1fdA0ZZKgBKlbtA/312uP59vjPjUYvVGgwjCd2iVtIWjhM4u3C7VyMCnPh9gQ++mEoYE1Hti6F/3PM+4j81HFU3quyvzIdAJdJFvQQ6Pv4pTNRjhr4BOMP1W9hUP10L2/4qbVRLiB/td158J;4:Cq90W1Ahggq2xiwuRk4NiOYLTONpz8fyFp2sDFUCameFgBrztNE/wvhiLaJDjh3I9FrgnfKaF+iaA79j8lPuHjWk2hxT66nK+gzqeQiX4vtBsTmMTSf4zEQ1zwnLoBG1rvklIoyryybDaflP+rMrk2r/Y85H6uKhQTu0m3InrZsiRJ6S0PikzbtyI8aaoLWuvqWwdLQKJFFSDCTY3TpW4HGIHz1nEybECOTC30nr908gxwvYMiWTvRK9Jo/PQRC3s7fClj365hAFK6KGUTKTCG+H1PHhEp6i6f3EmlRW1JocTRu3WZy97CiNhnErE7bXFEBPlEDhi+fmdetXyumibA== X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(5005006)(8121501046)(3002001)(3231020)(93006095)(93001095)(10201501046)(100000703101)(100105400095)(6055026)(6041248)(20161123562025)(20161123564025)(20161123555025)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(20161123558100)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1PR12MB0160;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1PR12MB0160; X-Forefront-PRVS: 0466CA5A45 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(39860400002)(376002)(346002)(199003)(189002)(54906003)(1076002)(6666003)(189998001)(68736007)(8676002)(305945005)(50226002)(7736002)(101416001)(76176999)(8936002)(97736004)(25786009)(81166006)(81156014)(16526018)(6486002)(478600001)(48376002)(2906002)(50466002)(4326008)(47776003)(66066001)(5660300001)(2950100002)(53936002)(106356001)(3846002)(50986999)(16586007)(53416004)(6116002)(5003940100001)(36756003)(33646002)(86362001)(105586002)(316002)(309714004);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1PR12MB0160;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;SN1PR12MB0160;23:IgaTYUYSJfpICR8yYJhC8VGxr6KYjpoO8HjQowkbH?= =?us-ascii?Q?RKKWys8l1+3GHOWxtkk9jz65fnLaHe5zsA5zh74V/Xdm33jU2bKW0fwc4e3s?= =?us-ascii?Q?WRN1j8oJn7u7R/KnQ5mByDD2fUghRrvGhhBt7cCROkKWpOG1OooK0wY3GSkF?= =?us-ascii?Q?zQ0kvrSFPpHN67qfRM8yBl+0hFUlgY31yYM7EdfIXCyJ9UohKPCHFLpVRS54?= =?us-ascii?Q?qDwRP+uxStZOvTuYq1ZI3734KuXoORN5jHS9tZC8UhAtJKgAfa3wTQfQXX+u?= =?us-ascii?Q?dRY35ClHUZEPpdv3dFZXjzJZJitXaG00NpRsaKI/6APO3M5aopvsIsB1CxBL?= =?us-ascii?Q?GIiklDG2N/rSnX0HcWm8hvaU6h9VHJUikVXDd04m+uxXKDeP722f6TC3WXKr?= =?us-ascii?Q?6+hYpL+j7VzTxzArMqIVjk6wdRMWfbyXnlHfXxYAEVjzDifbU49YrIrqrs+h?= =?us-ascii?Q?t1DIh8da/p9rFcvn+8jUgM5sWZoj8n5ii9ZZZCiCv6pAe6h9s1U+y6QMkl3q?= =?us-ascii?Q?le+p2rw9St3GGr8gNk7/wjU+NoCBKvwqs7m3uqwjks9T1uxOv5Ch/aW5DxV3?= =?us-ascii?Q?ewj/dhRNfFPWuJlmkFeHL22VYN8Z5/NcURMFrlKFnGae4NOhxHOoYYN0PGgd?= =?us-ascii?Q?F+lWkm12IQKEz6/eGzqxAONd/O4QihbPoues/lfhVvAyhfyu/wzaO+j9dme5?= =?us-ascii?Q?NwgXKbG7xwn9s75zZqArH6XUaxUcKtwPo1tJZBRnMT3dXQpUKex5se1sRE47?= =?us-ascii?Q?Ss9MEGk7+TAY7W0gzHBKyAh5HI6wg8KcAOGpfp2c0GR06xH0scweOsMiF4Pf?= =?us-ascii?Q?2ax7jQTSf/IQFNJqRiVQ1P2WxAY2eX7Xn4X8sfLpe6pB0sS7yA2otd1tYa1j?= =?us-ascii?Q?2dOs6oA7Q07Xy88M3fHSRileQKh7H+8K1qGN6+N22Bnw8bOxgs22dL/VT4GL?= =?us-ascii?Q?NeofhcwJFISj/yAeTfNTFQZmLAIl7eUQtlwq2hek9aiGNGTY9uJC/1WQ4dSp?= =?us-ascii?Q?50nYl/HY5cMm/RCl4iePthuvjsUhPFKV7U8ZrViukpJo5j7RHE1+sXq/xeaS?= =?us-ascii?Q?bETKqSu2W+IVg+J3JNYqzNHDL1cu7wCGdnJbd8E1cVbBEFrxqindFx/bn0im?= =?us-ascii?Q?xUmuja4O44=3D?= X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;6:SBw0shx395ctFq9Hk7AT+faiFIuWXPnvmuNEucD06jyr8C+tiKx9SFnhb0Kri/j6vYvOtJIcHidmM4j3RXXhILE3XUPniZbHzEHjrdydNuJ4n7hiQTJtOxuCc7vjxK8pCs5usKwr4ITBKi7ZAHLTtZj1E6kbMJPPlN2qhfBOa2XjqJcwq5+SnhJQ3t3R2SWntqwlpP2iBRpu7EYkUregLn05v8qZljJ3jz/vTT1KDnCoMB2gBiBDfORyZyjv4uZAZtIXdSBkom2VpLrPyn7de8e+S3X969fx3a39jPXT9+EHuJsZHRBj4/sA/dmaxCAuMk8QJHBK1PlTFYPJ/igOCg==;5:q5uiJeGXR35vLEVvzzD2O3qpxg5yChMeAZ2zwvbtAXbjN056l+LHhUp0UIoLD975v4rhOfJBGCH87eVzPSlknfabaWxHNdYfvfK5rvlXL9/nCOlcJcJPgOPYNID4Mh6A/11nAia1GctsmseF5/ocKg==;24:PY30IHQW7jz3FhCUuZ+fumwLBfgr3Qgi9WvzWif18lGge+XshIbVAs5HxT+HzEAN6UnZ5rgHTW83b6LZuKa3VSfSlv/VhQ/dGMUCK4aPb6Q=;7:QUl3B5452NUe0i3Hv9+C6ZW8JlG9etOssJ1bDVPfLp9zgih8mruMfCCfASWapr7cfDM5Jlsc/DvJq3LhRinnhC04G3aCsLVg4ebajd8jloYt/LpzdRwod/RY17xWGVUN2l4EbsaUMTg89jZUtceb5NCwN7rvX30nh13xt9jECn85BI4w2SPDVoqdkXHGLR+Yy4vrLaLV7EBN1H5jgDVmD6lRJZq5TBwj+S51HiMgQrg= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0160;20:dgDpsZgj0LpwzZGA5VQmARGcp6u3qbz39RdzrIdMz7fTb33oCArvZvY0iRfoRifsHf4knVxempVA76vgHLWHjvl31rUOYQmv0H2fV4GFxsJtaspKxZPLED+LOWWMwqiYOrl9Zc9N0IZHA9Rd+XJV0ZuyonhZzDrswhBUX4JmHgo31u/9PmzWrogzWG66wk/FVa+xpiN4yUFcBrB5nmWRBdDqWDRC69J3QHxJhVh9y2UPPy8bvYa1p2Q2yDsqJOEh X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2017 14:31:14.8761 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 787b08ca-2e00-4be3-08f6-08d517c738bd X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0160 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tom Lendacky Provide support for Secure Encrypted Virtualization (SEV). This initial support defines a flag that is used by the kernel to determine if it is running with SEV active. Signed-off-by: Tom Lendacky Signed-off-by: Brijesh Singh Reviewed-by: Borislav Petkov Tested-by: Borislav Petkov Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Borislav Petkov Cc: Andy Lutomirski Cc: linux-kernel@vger.kernel.org Cc: x86@kernel.org --- arch/x86/include/asm/mem_encrypt.h | 6 ++++++ arch/x86/mm/mem_encrypt.c | 26 ++++++++++++++++++++++++++ include/linux/mem_encrypt.h | 7 +++++-- 3 files changed, 37 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/mem_encrypt.h b/arch/x86/include/asm/mem_encrypt.h index 6a77c63540f7..2b024741bce9 100644 --- a/arch/x86/include/asm/mem_encrypt.h +++ b/arch/x86/include/asm/mem_encrypt.h @@ -47,6 +47,9 @@ void __init mem_encrypt_init(void); void swiotlb_set_mem_attributes(void *vaddr, unsigned long size); +bool sme_active(void); +bool sev_active(void); + #else /* !CONFIG_AMD_MEM_ENCRYPT */ #define sme_me_mask 0ULL @@ -64,6 +67,9 @@ static inline void __init sme_early_init(void) { } static inline void __init sme_encrypt_kernel(void) { } static inline void __init sme_enable(struct boot_params *bp) { } +static inline bool sme_active(void) { return false; } +static inline bool sev_active(void) { return false; } + #endif /* CONFIG_AMD_MEM_ENCRYPT */ /* diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c index 16c5f37933a2..add836d3d174 100644 --- a/arch/x86/mm/mem_encrypt.c +++ b/arch/x86/mm/mem_encrypt.c @@ -42,6 +42,8 @@ static char sme_cmdline_off[] __initdata = "off"; u64 sme_me_mask __section(.data) = 0; EXPORT_SYMBOL_GPL(sme_me_mask); +static bool sev_enabled __section(.data); + /* Buffer used for early in-place encryption by BSP, no locking needed */ static char sme_early_buffer[PAGE_SIZE] __aligned(PAGE_SIZE); @@ -192,6 +194,30 @@ void __init sme_early_init(void) protection_map[i] = pgprot_encrypted(protection_map[i]); } +/* + * SME and SEV are very similar but they are not the same, so there are + * times that the kernel will need to distinguish between SME and SEV. The + * sme_active() and sev_active() functions are used for this. When a + * distinction isn't needed, the mem_encrypt_active() function can be used. + * + * The trampoline code is a good example for this requirement. Before + * paging is activated, SME will access all memory as decrypted, but SEV + * will access all memory as encrypted. So, when APs are being brought + * up under SME the trampoline area cannot be encrypted, whereas under SEV + * the trampoline area must be encrypted. + */ +bool sme_active(void) +{ + return sme_me_mask && !sev_enabled; +} +EXPORT_SYMBOL_GPL(sme_active); + +bool sev_active(void) +{ + return sme_me_mask && sev_enabled; +} +EXPORT_SYMBOL_GPL(sev_active); + /* Architecture __weak replacement functions */ void __init mem_encrypt_init(void) { diff --git a/include/linux/mem_encrypt.h b/include/linux/mem_encrypt.h index 265a9cd21cb4..b310a9c18113 100644 --- a/include/linux/mem_encrypt.h +++ b/include/linux/mem_encrypt.h @@ -23,11 +23,14 @@ #define sme_me_mask 0ULL +static inline bool sme_active(void) { return false; } +static inline bool sev_active(void) { return false; } + #endif /* CONFIG_ARCH_HAS_MEM_ENCRYPT */ -static inline bool sme_active(void) +static inline bool mem_encrypt_active(void) { - return !!sme_me_mask; + return sme_me_mask; } static inline u64 sme_get_me_mask(void) -- 2.9.5